Since I wrote the original code for this component and it's just a minor addition, I'm going to merge it myself.

OSTree commit objects are a bit special from regular files. The signature is not directly a detached GPG signature file, but a special commitmeta object which contains the OSTree. Offhand, quickly looking at the code, I think we need to pass the OSTree commit separately down to process_coreos, where it can use sign-ostree instead of sign-data (or reuse the build_atomic_cmdline).

Because Pagure doesn't let me edit my comment. That sentence should've been:

The signature is not directly a detached GPG signature file, but a special commitmeta OSTree object which embeds the signature.

BTW, does robosignatory emit a message after having signed the artifacts? We'll need some way on the pipeline side to know when signing was done (see the bottom of https://github.com/coreos/fedora-coreos-tracker/issues/198#issuecomment-513944390).

We could poll the bucket for now, though would be cleaner to just listen for the completion message.

Ah. I'm not familiar with the sign-ostree Sigul subcommand and the filenames that should be used, could I chat with someone on the team on IRC to figure that out? Will the sign-ostree command produce the commitmeta file that I should upload back?
Thanks.
I can also add the emission of a message on completion, that shouldn't be a problem.

Will the sign-ostree command produce the commitmeta file that I should upload back?

(Caveat: I just read over the sigul codebase for the first time before answering this). Right, it'll spit out a commitmeta file, which you can upload back to the same bucket dir, let's say as ostree-commitmeta-object ?

I can also add the emission of a message on completion, that shouldn't be a problem.

Awesome, thanks!

could I chat with someone on the team on IRC to figure that out?

Yes, feel free to reach out to me or someone else on freenode/#fedora-coreos. Otherwise, happy to schedule a meeting too for higher-bandwidth!